Back to results
US 2018/0101362 A1Published application
Unknown
AssigneeIdemia Identity & Security France
InventorsVictor SERVANT, Guillaume DABOSVILLE
Life of this patent
Estimating the term…
Loading patent…
Loading patent…
AssigneeIdemia Identity & Security France
InventorsVictor SERVANT, Guillaume DABOSVILLE
Estimating the term…
The invention relates to a cryptographic processing method comprising multiplication of a point P of an elliptic curve on a Galois field by a scalar k, the multiplication comprising steps of: storing, in a first register, a zero point of the Galois field, executing a loop comprising at least one iteration comprising steps of: selecting a window of w bits in the non-signed binary representation of the scalar k, w being a predetermined integer independent of the scalar k and strictly greater than 1, calculating multiple points of P being each associated with a bit of the window and of the form ±2iP, adding or not in the first register of multiple points stored, depending of the value of the bit of the window with which the multiple points are associated, wherein the loop ends once each bit of the non-signed binary representation of the scalar k has been selected, returning a value stored in the first register. If all the bits of the window selected during an iteration of the loop are zero, the iteration comprises at least one dummy execution of the addition function, and/or if all the bits of the window during an iteration of the loop are non-zero, the multiple points to be added in the first register during the step are determined from a non-adjacent form associated with the window.
A cryptographic processing method executed by at least one processor (2), the method comprising multiplication of a point P of an elliptic curve on a Galois field by a scalar k, multiplication comprising steps of:
The method according to the preceding claim, wherein for each iteration of the loop, there is n+m≥1, where n is the number of any dummy executions of the addition function during the iteration, and m is the number of any executions of the addition function during the addition step (106) of the iteration.
The method according to the preceding claim, wherein n+m is identical for several iterations of the loop, or even for all the iterations of the loop.
The method according to any of the preceding claims, wherein the windows are selected according to order of reading of the binary representation of the scalar k going from right to left.
The method according to any of the preceding claims, wherein, if several bits of the window selected during an iteration of the loop are non-zero, then multiples are added in the first register during the iteration in random order.
The method according to any of the preceding claims, wherein, if all the bits of the window selected during an iteration of the loop are non-zero, a multiple point of negative value associated with a least significant bit of said non-adjacent form is added in the first register during the iteration.
The method according to any of the preceding claims, wherein, if all the bits of the window selected during an iteration of the loop are non-zero, a multiple point associated with a most significant bit of said non-adjacent form is added in the first register in a later iteration or after the end of the loop.
The method according to any of the preceding claims, wherein, if all the bits of the window selected during the q-th iteration of the loop are non-zero, a multiple point of value 2qwP is added in the first register during the q-th iteration.
A computer program product comprising program code instructions for executing the steps of the cryptographic processing method, according to any of the preceding claims, when this method is executed by at least one processor (2).
A cryptographic processing device (1) comprising
A smart card (8) comprising a cryptographic processing device (1), according to the preceding claim.
Dependencies are inferred from the claim text.